k3s/ansible/roles/k3s/tasks/main.yml

# K3s 安装 Role (统一 Server 和 Agent)
---
- name: Validate TAILSCALE_AUTH_KEY
  ansible.builtin.fail:
    msg: "请设置环境变量: export TAILSCALE_AUTH_KEY='tskey-auth-xxx'"
  when: (tailscale_auth_key | default('')) | length == 0

- name: Create K3s config directory
  ansible.builtin.file:
    path: /etc/rancher/k3s
    state: directory
    mode: "0755"

# 检查安装状态
- name: Check if K3s is installed
  ansible.builtin.stat:
    path: /usr/local/bin/k3s
  register: k3s_binary

# 检查当前K3s版本
- name: Check current K3s version
  ansible.builtin.command:
    cmd: /usr/local/bin/k3s --version
  register: k3s_current_version
  failed_when: false
  changed_when: false
  when: k3s_binary.stat.exists

# 部署配置文件（注册变更状态）
- name: Deploy K3s server config
  ansible.builtin.template:
    src: k3s-server.yaml.j2
    dest: /etc/rancher/k3s/config.yaml
    mode: "0600"
  when: "'masters' in group_names"
  register: k3s_server_config
  no_log: true

- name: Deploy K3s agent config
  ansible.builtin.template:
    src: k3s-agent.yaml.j2
    dest: /etc/rancher/k3s/config.yaml
    mode: "0600"
  when: "'agents' in group_names"
  register: k3s_agent_config
  no_log: true

- name: Deploy registries.yaml
  ansible.builtin.template:
    src: registries.yaml.j2
    dest: /etc/rancher/k3s/registries.yaml
    mode: "0644"
  when: use_mirror | default(false)

# 判断是否需要安装/重启
# 使用 -e force_reinstall=true 可强制重新安装
- name: Set K3s installation flag
  ansible.builtin.set_fact:
    k3s_needs_install: "{{ 
      not k3s_binary.stat.exists or 
      (force_reinstall | default(false) | bool) or 
      (k3s_server_config.changed | default(false)) or 
      (k3s_agent_config.changed | default(false)) or
      (k3s_binary.stat.exists and k3s_current_version.stdout is defined and k3s_version not in k3s_current_version.stdout)
    }}"

# 设置安装变量
- name: Set K3s install variables
  ansible.builtin.set_fact:
    k3s_install_url: "{{ mirror_k3s_install_url if (use_mirror | default(false)) else global_k3s_install_url }}"
    k3s_install_mirror: "{{ 'INSTALL_K3S_MIRROR=cn' if (use_mirror | default(false)) else '' }}"


# 下载安装脚本
- name: Save an uncompressed etcd snapshot before upgrading
  ansible.builtin.command:
    argv:
      - /usr/local/bin/k3s
      - etcd-snapshot
      - save
      - --etcd-snapshot-name
      - "pre-upgrade-{{ k3s_version }}"
      - --etcd-snapshot-compress=false
  when:
    - "'masters' in group_names"
    - k3s_binary.stat.exists
    - k3s_needs_install
  changed_when: true

- name: Preserve the server token needed to restore the snapshot
  ansible.builtin.copy:
    src: /var/lib/rancher/k3s/server/token
    dest: "/var/lib/rancher/k3s/server/pre-upgrade-{{ k3s_version }}.token"
    remote_src: true
    mode: "0600"
    force: false
  when:
    - "'masters' in group_names"
    - k3s_binary.stat.exists
    - k3s_needs_install
  no_log: true

- name: Download K3s install script
  ansible.builtin.get_url:
    url: "{{ k3s_install_url }}"
    dest: /tmp/k3s-install.sh
    mode: "0755"
  when: k3s_needs_install

# 安装 K3s
- name: Install K3s server
  ansible.builtin.command:
    cmd: /tmp/k3s-install.sh server
  environment:
    INSTALL_K3S_VERSION: "{{ k3s_version }}"
    INSTALL_K3S_MIRROR: "{{ 'cn' if (use_mirror | default(false)) else '' }}"
  when:
    - "'masters' in group_names"
    - k3s_needs_install
  changed_when: true

- name: Install K3s agent
  ansible.builtin.command:
    cmd: /tmp/k3s-install.sh agent
  environment:
    INSTALL_K3S_VERSION: "{{ k3s_version }}"
    INSTALL_K3S_MIRROR: "{{ 'cn' if (use_mirror | default(false)) else '' }}"
  when:
    - "'agents' in group_names"
    - k3s_needs_install
  changed_when: true

# 清理安装脚本
- name: Remove install script
  ansible.builtin.file:
    path: /tmp/k3s-install.sh
    state: absent

# /readyz includes the local API server's etcd readiness check.
- name: Wait for the local API server and etcd to be ready
  ansible.builtin.command:
    argv:
      - /usr/local/bin/k3s
      - kubectl
      - --kubeconfig=/etc/rancher/k3s/k3s.yaml
      - --request-timeout=10s
      - get
      - --raw=/readyz
  register: k3s_api_ready
  until: k3s_api_ready.rc == 0 and k3s_api_ready.stdout == 'ok'
  retries: 60
  delay: 5
  changed_when: false
  when: "'masters' in group_names"

- name: Wait for the node to report Ready at the requested version
  ansible.builtin.command:
    argv:
      - /usr/local/bin/k3s
      - kubectl
      - --kubeconfig=/etc/rancher/k3s/k3s.yaml
      - --request-timeout=10s
      - get
      - node
      - "{{ node_hostname | default(inventory_hostname) }}"
      - -o
      - json
  delegate_to: "{{ inventory_hostname if inventory_hostname in groups['masters'] else init_node }}"
  # Worker installs stay parallel; avoid exhausting the shared master's SSH sessions.
  throttle: 5
  vars:
    ansible_port: "{{ hostvars[inventory_hostname].ansible_port if inventory_hostname in groups['masters'] else hostvars[inventory_hostname].init_node_port }}"
  register: k3s_node_status
  until: >-
    k3s_node_status.rc == 0 and
    (k3s_node_status.stdout | from_json).status.nodeInfo.kubeletVersion == k3s_version and
    ((k3s_node_status.stdout | from_json).status.conditions |
      selectattr('type', 'equalto', 'Ready') |
      selectattr('status', 'equalto', 'True') | list | length) == 1
  retries: 60
  delay: 5
  changed_when: false

# 保存 kubeconfig (仅 cluster-init)
- name: Fetch kubeconfig
  ansible.builtin.fetch:
    src: /etc/rancher/k3s/k3s.yaml
    dest: "{{ playbook_dir }}/../kubeconfig.yaml"
    flat: true
  when: cluster_init | default(false)

- name: Update kubeconfig server address
  ansible.builtin.replace:
    path: "{{ playbook_dir }}/../kubeconfig.yaml"
    regexp: 'server: https://127\.0\.0\.1:6443'
    replace: "server: {{ k3s_server_url }}"
  delegate_to: localhost
  become: false
  when: cluster_init | default(false)